[hsitz]

"> Unfortunately, for the individual victim, paying is usually the best of a set of bad options

Is it?"

Also, think what would happen if a ransomer failed to give the data back after being paid. The only benefit for the ransomer on that mark is to then say, "No, now I want x-more dollars." What is the mark going to do then, once the ransomer has proven untrustworthy? Give them yet more money?

[iamsohungry]

99% of the time, no, the mark will give them nothing, but it only takes 1% to make it viable.

I do buy the reputation argument when applied on a larger scale, though. I didn't realize that some of these operations were as large as other commenters have pointed out.